Do Internal Controls Work in Practice? From Annual Reporting to Continuous Regulatory Readiness
A business entity may have approved policies, a delegation-of-authority matrix, procedure manuals, and sophisticated systems, yet its annual review may still find that a control was not performed, cannot be evidenced, or no longer reflects the approved procedure. That leads to a question that should be asked well before the regulatory reporting deadline: do the internal controls work in practice, or do they only appear complete on paper?
In Kuwait’s regulatory environment, an internal control review is more than an administrative exercise completed before a deadline. Business entities subject to the applicable instructions of the Capital Markets Authority or the Central Bank of Kuwait, depending on their legal and licensing status, are expected to maintain controls proportionate to the nature, scale, and risks of their activities.
They may also be required to appoint an independent auditor or audit firm to conduct the review and issue the prescribed report. The real value, however, begins when the review moves from an annual document-gathering race to a continuous discipline that strengthens governance, improves information quality, and identifies weaknesses before they become regulatory or operational failures.
Read more about: Relationship Between Internal Control & Internal Audit
Why does late preparation expose avoidable problems?
When preparation begins shortly before the report is due, departments become occupied with locating the latest policies, obtaining missing approvals, and searching for evidence of controls performed months earlier. The business entity may then discover a gap between documented procedures and actual practice, an unclear control owner, or a recurring management report for which there is no reliable evidence of review and approval.
These situations do not necessarily mean that no control exists. They may instead indicate a weakness in its design, documentation, or sustainable operation.
The later such a weakness is identified, the less time remains to analyze the root cause, implement the remediation, and generate sufficient operating evidence showing that the correction has become part of business as usual. Genuine readiness is therefore not a file assembled before the reviewer arrives; it is a control lifecycle that can be traced at any time.
An approved policy is not evidence that a control is effective
A written policy is essential, but it does not by itself demonstrate that a control operates effectively. An independent reviewer will ordinarily consider several connected questions. Is the control designed to address the identified risk? Is it assigned to a person with appropriate authority and competence? Was it performed at the required frequency? Did the review or approval involve meaningful challenge, or was it only a formal sign-off? Is there complete, dated evidence that allows an independent party to retrace what occurred?
Consider a simple example: the policy requires a monthly review of user access. Providing the policy or a year-end user listing is not enough. Stronger evidence identifies the complete user population reviewed, the reviewer, the exceptions found, the decisions made, and the dates on which corrective actions were closed. Similarly, committee minutes do not, on their own, demonstrate effective oversight unless they show what information was considered, the significant questions or decisions, responsibility for follow-up and the status of previous actions.
What makes a business entity review-ready throughout the year?
Readiness starts with a clear map of the regulatory requirements applicable to the entity. Obligations differ according to the regulator, license, activities, products, and legal structure. Each requirement should be connected to the relevant policy, the risk it addresses, the responding control, the control owner, the required frequency and the expected evidence. This mapping turns dispersed obligations into a system that can be managed and tested.
Clear control ownership comes next. Compliance or internal audit may coordinate monitoring, but they should not automatically become the owners of controls performed by operational, finance, or technology functions. The real owner is the person who has the ability to perform the control and correct deviations. Where ownership is unclear, responses remain general, evidence is delayed, and findings stay open between several departments.
Readiness also requires disciplined evidence management. Every control should have a defined description of suitable evidence, where it is retained, how long it is retained, and how its integrity and confidentiality are protected.
The number of files is not a measure of evidence quality. A single record showing the inputs, review, exceptions, approval, and follow-up can be more valuable than dozens of undated screenshots that are not linked to a defined sample.
Changes must also be addressed when they occur. A new product, revised organizational structure, system upgrade, outsourcing arrangement or change in approval limits may make an existing control unsuitable. The change-management process should therefore consider the effect on risks, controls, policies, authority matrices and regulatory reports, instead of waiting for the annual review to reveal that documents and practices are no longer aligned.
Technology and outsourcing form part of the control environment
Modern processes depend on systems, data and technology interfaces. Many operational and financial controls therefore cannot be assessed without considering relevant information technology general controls. User access, change management, segregation between development and operations, backups, incident handling and data quality may directly affect the reliability of controls and reports.
The same principle applies to outsourced services. A service provider may perform part of a process, but outsourcing does not transfer management’s responsibility for control.
Contracts should define service levels, confidentiality and security requirements, audit rights, incident-reporting arrangements, and continuity and exit provisions. The business entity should also monitor the provider’s performance, deficiencies and corrective actions through evidence that can be independently assessed.
Prior findings: administrative closure is not effective remediation
A common weakness is to regard a finding as closed once a revised policy has been issued, or an email confirms that the action is complete. Professional closure requires confirmation that the root cause was addressed, the revised control was implemented, it operated long enough to produce suitable evidence, and the residual risk was accepted by the appropriate level of management. Depending on the nature and significance of the finding, this may require independent follow-up testing or a new sample.
It is also useful to analyze findings by root cause and trend rather than track them only as isolated cases. Repeated delays in approvals across several departments may point to a weakness in the delegation-of-authority matrix or workflow design, not a series of individual mistakes.
Repeated evidence gaps may indicate that a control relies on an undefined manual practice or that the system does not retain an adequate audit trail. Viewed this way, review results become management information that helps the board, audit committee and executive management prioritize improvement.
Clear accountability and independent assurance
Responsibility for designing, implementing and monitoring internal controls remains with the board of directors and executive management, each within its remit. Risk, compliance and internal audit functions support that responsibility in accordance with their approved roles, while the independent reviewer provides an objective assessment under the applicable regulatory requirements, engagement scope and reporting basis.
An independent review does not replace day-to-day monitoring, nor does it guarantee that no future error or override will occur. Controls provide an appropriate level of assurance within their inherent limitations and may be affected by human judgment, collusion, management override and changes in systems or processes.
Read more about: Financial Statements Audit Vs. Internal Control Review
A practical readiness test
At any point in the year, management should be able to ask: do we know all regulatory requirements applicable to us? Does every significant risk have a defined control and accountable owner? Do approved policies reflect actual practice and the systems in use? Can we retrieve complete and dated evidence for any relevant period or sample? Are exceptions escalated and corrected within defined timelines? Have we verified the effective remediation of prior findings, rather than merely changed their status?
If one or more of these questions cannot be answered with evidence, the issue is not simply the proximity of the next review. It is the need to improve continuous readiness. Starting early is not about creating a temporary appearance of compliance; it is about ensuring that appropriate controls form part of how the business entity operates throughout the year.
Start before the countdown begins
The best time to discuss an internal control review is not when the filing deadline is approaching. It is when there is sufficient time to understand the applicable instructions, define the information required, coordinate the participation of departments, and resolve bottlenecks in evidence collection. Early planning makes the review more efficient and gives the board and executive management clearer insight into control maturity and the risks that deserve priority.
Baker Tilly Kuwait provides internal control review services through licensed auditors and a specialized team, in accordance with the relevant requirements issued by Kuwait’s regulatory authorities and the agreed engagement scope. If your organization is preparing for its next review cycle, contact us early to discuss the applicable requirements, scope of work, and an appropriate timetable for issuing the regulatory report.
Please contact the Business Development Department at +965 1887 799 , Ext.: 335, and a meeting can be arranged accordingly for further discussion.